PT-2023-29935 · Spicedb · Spicedb
Timdiekmann
·
Publicado
2023-10-31
·
Atualizado
2024-08-21
·
CVE-2023-46255
CVSS v3.1
4.2
Média
| Vetor | AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
SpiceDB versions prior to 1.27.0-rc1
Description
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. When the provided datastore URI is malformed, such as having a password that contains a colon (
:), the full URI, including the provided password, is printed, resulting in the password being shown in the logs.Recommendations
For SpiceDB versions prior to 1.27.0-rc1, update to version 1.27.0-rc1 or later to resolve the issue. As a temporary workaround, consider sanitizing log outputs to prevent exposure of sensitive information, such as passwords, until a patch is applied. Restrict access to log files to minimize the risk of exploitation. Avoid using passwords that contain special characters, such as colons, in datastore URIs until the issue is resolved.
Exploit
Correção
Insertion into Log File
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Spicedb